@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/platforms/fortios/names.ts

@@ -1,20 +1,27 @@
 // How the platform names what the config names: ports and interfaces, prefixes, and the routing table an interface sits in.
 
 import { Address } from "../../core/address";
-import type { Device, Family } from "../../schema";
+import type { Device, Family } from "../../model";
 import { Catalog } from "../catalog";
+import { Derive, type NamedInterface } from "../derive";
 
-type Addressed = { addresses?: readonly (string | { address: string; peer?: string })[]; vrf?: string; lag?: string };
+type Addressed = { addresses?: readonly (string | { address: string; peer_address?: string })[]; vrf?: string; in_lag?: string };
 
 export class FortiOsNames {
     /** The bridges a device has, in the config's order. A device with any runs in transparent mode, each bridge a forward domain numbered by its place. */
     static bridgesOf(device: Device): { name: string; members: readonly string[] }[] {
-        return Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) =>
-            iface.type === "bridge" ? [{ name, members: iface.members }] : []
+        return Object.entries(device.interfaces?.bridge ?? {}).flatMap(([name, bridge]) =>
+            bridge ? [{ name, members: bridge.member_interfaces }] : []
         );
     }
 
+    /** Whether an interface is a GRE or VXLAN tunnel. */
+    static isTunnel(device: Device, name: string): boolean {
+        return Boolean(device.interfaces?.gre?.[name] ?? device.interfaces?.vxlan?.[name]);
+    }
+
     /** Whether the device runs in transparent mode: it has a bridge. */
+
     static isTransparent(device: Device): boolean {
         return FortiOsNames.bridgesOf(device).length > 0;
     }
@@ -26,12 +33,7 @@ export class FortiOsNames {
         if (!FortiOsNames.isTransparent(device)) return undefined;
 
         const members = new Set(FortiOsNames.bridgesOf(device).flatMap((bridge) => bridge.members));
-        const holders = [...Object.entries(device.ports ?? {}), ...Object.entries(device.interfaces ?? {})] as [
-            string,
-            Addressed | undefined,
-        ][];
-
-        for (const [name, settings] of holders) {
+        for (const [name, settings] of FortiOsNames.holders(device)) {
             if (members.has(name)) continue;
             const address = FortiOsNames.addressesOf(settings).find((each) => Address.family(Address.host(each)) === "ipv4");
             if (address) return { name, address };
@@ -48,13 +50,48 @@ export class FortiOsNames {
 
     /** The name the platform gives a port or an interface: a port by its spelling, any other interface by its key. */
     static nameOf(device: Device, name: string): string {
-        if (device.interfaces && name in device.interfaces) return name;
+        if (FortiOsNames.interfacesOf(device).some((entry) => entry.name === name)) return name;
+
         return Catalog.spell(device.platform, device.model, name);
     }
 
     /** A port's or an interface's settings, by its key. */
     static settingsOf(device: Device, name: string): Addressed | undefined {
-        return (device.interfaces?.[name] ?? device.ports?.[name as keyof typeof device.ports]) as Addressed | undefined;
+        return Derive.settings(device, name);
+    }
+
+    /**
+     * Every interface that is not a port, in the order the config writes them: its groups in the order they are written, and each group's interfaces in theirs. Where an order shows on the device, such as the interfaces NTP answers on, it is this one.
+     */
+    static interfacesOf(device: Device): NamedInterface[] {
+        return Object.entries(device.interfaces ?? {}).flatMap(([kind, group]) =>
+            kind === "ethernet"
+                ? []
+                : Object.entries((group ?? {}) as Record<string, NamedInterface["settings"] | undefined>).flatMap(([name, settings]) =>
+                      settings ? [{ name, kind: kind as NamedInterface["kind"], settings }] : []
+                  )
+        );
+    }
+
+    /** Every port, then every other interface, by key, with its settings. */
+    private static holders(device: Device): [string, Addressed][] {
+        return [
+            ...Derive.ports(device),
+            ...FortiOsNames.interfacesOf(device).map(({ name, settings }) => [name, settings] as [string, Addressed]),
+        ];
+    }
+
+    /** The sources `management.allow` names: its prefixes, or the members of the address set it names. */
+    static allowed(device: Device): readonly string[] {
+        const allow = device.management?.allow;
+        if (typeof allow !== "string") return allow ?? [];
+
+        return device.firewall?.address_sets?.[allow] ?? [];
+    }
+
+    /** The one value a match field holds, or undefined. A list is one value per rule, which Circuit writes out before the platform reads it; `unsupported()` refuses a list of several. */
+    static single<T>(value: T | readonly T[] | undefined): T | undefined {
+        return Array.isArray(value) ? (value as readonly T[])[0] : (value as T | undefined);
     }
 
     /** Every address of a port or an interface. */
@@ -84,16 +121,12 @@ export class FortiOsNames {
 
     /** The number of a VRF on the platform: its place among the device's VRFs, the default table being 0. */
     static vrfNumber(device: Device, vrf: string | undefined): number {
-        return vrf ? Object.keys(device.vrfs ?? {}).indexOf(vrf) + 1 : 0;
+        return vrf ? Object.keys(device.routing?.vrfs ?? {}).indexOf(vrf) + 1 : 0;
     }
 
     /** Every port and interface that routes, by key, with its settings. A LAG member routes through its LAG. */
     private static routedHolders(device: Device): [string, Addressed][] {
-        const holders = [...Object.entries(device.ports ?? {}), ...Object.entries(device.interfaces ?? {})] as [
-            string,
-            Addressed | undefined,
-        ][];
-        return holders.filter((holder): holder is [string, Addressed] => holder[1] !== undefined && !holder[1].lag);
+        return FortiOsNames.holders(device).filter(([, settings]) => !settings.in_lag);
     }
 
     /** The interface whose own network holds an address, the most specific when several do, in one routing table. */

package/src/platforms/fortios/render.ts

@@ -2,8 +2,10 @@
 
 import { Address } from "../../core/address";
 import { Secrets } from "../../core/secrets";
-import type { Device, Helper, Severity } from "../../schema";
+import { Utils } from "../../core/utils";
+import type { Device, Gre, Helper, Severity, StaticRoute, Vxlan } from "../../model";
 import { Catalog } from "../catalog";
+import { Derive } from "../derive";
 import { FortiOsFirewall } from "./firewall";
 import { FortiOsNames } from "./names";
 import { FortiOsRouting } from "./routing";
@@ -13,7 +15,7 @@ import { FortiOsVdoms } from "./vdoms";
 export type Section = (typeof FortiOsRender.SECTIONS)[number];
 
 type RoutedSettings = {
-    addresses?: readonly (string | { address: string; peer: string })[];
+    addresses?: readonly (string | { address: string; peer_address: string })[];
     vrrp?: readonly { id: number; address: string; priority?: number; preempt?: boolean; interval?: number }[];
     lldp?: boolean;
     vrf?: string;
@@ -251,10 +253,10 @@ export class FortiOsRender {
 
         if (management.https) services.push("https");
         if (management.ssh) services.push("ssh");
-        if (management.snmp) services.push("snmp");
+        if (device.monitoring?.snmp) services.push("snmp");
         if (management.http) services.push("http");
         if (management.telnet) services.push("telnet");
-        if (management.native) services.push("fgfm");
+        if (management.native_protocol) services.push("fgfm");
 
         return services.join(" ");
     }
@@ -289,7 +291,7 @@ export class FortiOsRender {
         FortiOsRender.logging(root, device);
         FortiOsRender.flowExport(root, device);
         FortiOsRender.dhcpServers(section("system dhcp server"), device);
-        FortiOsRender.staticRoutes(section("router static"), section("router static6"), device);
+        FortiOsRender.staticRoutes(section("router static"), section("router static6"), device, device.routing?.static_routes ?? []);
         FortiOsRouting.render(root, device);
         FortiOsRender.helpers(section("system session-helper"), device);
         FortiOsFirewall.render(root, device);
@@ -300,16 +302,13 @@ export class FortiOsRender {
 
     /** A management VDOM's routes, and who reaches the device's own services through it, as sections of their own after everything else. */
     private static managementVdom(root: FortiOsBlock, device: Device): void {
-        const management = device.vdoms?.management;
+        const management = device.system?.vdoms?.management;
         if (!management) return;
 
         const vdom = new FortiOsBlock();
         for (const section of FortiOsVdoms.MANAGEMENT_SECTIONS) vdom.block(section);
 
-        FortiOsRender.staticRoutes(vdom.block("router static"), vdom.block("router static6"), {
-            ...device,
-            routing: { static: management.static ?? [] },
-        });
+        FortiOsRender.staticRoutes(vdom.block("router static"), vdom.block("router static6"), device, management.static_routes ?? []);
         FortiOsFirewall.managementOnly(vdom, device);
 
         for (const [section, block] of vdom.blocks) root.blocks.set(FortiOsVdoms.key(management.name, section), block);
@@ -317,8 +316,10 @@ export class FortiOsRender {
 
     /** A certificate with its key is the device's own; one without is only trusted. */
     private static certificates(local: FortiOsBlock, trusted: FortiOsBlock, device: Device): void {
-        for (const [name, certificate] of Object.entries(device.certificates ?? {})) {
-            const text = FortiOsTree.quote(certificate.certificate.trim());
+        for (const [name, certificate] of Object.entries(device.system?.certificates ?? {})) {
+            if (!certificate) continue;
+
+            const text = FortiOsTree.quote(Utils.projectFile(certificate.certificate_file).trim());
 
             if (certificate.private_key)
                 local
@@ -348,7 +349,7 @@ export class FortiOsRender {
         if (management.http) block.set("admin-https-redirect", "disable");
         if (device.system?.banner) block.set("pre-login-banner", "enable");
 
-        if (device.lldp === true) block.set("lldp-transmission", "enable").set("lldp-reception", "enable");
+        if (device.switching?.lldp === true) block.set("lldp-transmission", "enable").set("lldp-reception", "enable");
 
         const vdom = FortiOsVdoms.managementOf(device);
         if (vdom) block.set("vdom-mode", "multi-vdom").set("management-vdom", FortiOsTree.quote(vdom));
@@ -356,7 +357,8 @@ export class FortiOsRender {
 
     /** Each user, with the profile its role takes. */
     private static users(profiles: FortiOsBlock, admins: FortiOsBlock, device: Device): void {
-        const roles = new Set(Object.values(device.users ?? {}).map((user) => user.role));
+        const users = Object.entries(device.system?.users ?? {}).flatMap(([name, user]) => (user ? [[name, user] as const] : []));
+        const roles = new Set(users.map(([, user]) => user.role));
 
         // An operator changes everything but the system's own settings, which hold the users; read-only changes nothing.
         for (const role of ["operator", "read-only"] as const) {
@@ -367,7 +369,7 @@ export class FortiOsRender {
                 profile.set(group, role === "operator" && group !== "sysgrp" ? "read-write" : "read");
         }
 
-        for (const [name, user] of Object.entries(device.users ?? {})) {
+        for (const [name, user] of users) {
             const admin = admins.entry(name);
 
             admin.set("accprofile", FortiOsTree.quote(FortiOsRender.PROFILE[user.role]));
@@ -384,7 +386,7 @@ export class FortiOsRender {
         const access = FortiOsRender.allowAccess(device);
 
         for (const port of Catalog.ports(device.platform, device.model)) {
-            const settings = device.ports?.[port as keyof typeof device.ports];
+            const settings = device.interfaces?.ethernet?.[port];
             const entry = block.entry(Catalog.spell(device.platform, device.model, port));
 
             entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, port)));
@@ -402,18 +404,18 @@ export class FortiOsRender {
             if (speed) entry.set("speed", speed);
 
             // A port in a LAG has no redirects of its own: `command parse error`.
-            if (settings.lag) continue;
+            if (settings.in_lag) continue;
 
             FortiOsRender.redirects(entry, device);
             if (settings.mtu) entry.set("mtu-override", "enable").set("mtu", settings.mtu);
             FortiOsRender.routed(entry, device, port, settings, access);
         }
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type !== "lag") continue;
+        for (const [name, iface] of Object.entries(device.interfaces?.lag ?? {})) {
+            if (!iface) continue;
 
-            const members = Object.entries(device.ports ?? {})
-                .filter(([, port]) => port?.lag === name)
+            const members = Derive.ports(device)
+                .filter(([, port]) => port.in_lag === name)
                 .map(([port]) => Catalog.spell(device.platform, device.model, port));
 
             const entry = block.entry(name);
@@ -427,14 +429,14 @@ export class FortiOsRender {
             FortiOsRender.routed(entry, device, name, iface, access);
         }
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type !== "vlan") continue;
+        for (const [name, iface] of Object.entries(device.interfaces?.vlan_interface ?? {})) {
+            if (!iface) continue;
 
             const parent = FortiOsRender.vlanParent(device, iface.vlan);
             const entry = block.entry(name);
             entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, name)));
             if (parent) entry.set("interface", FortiOsTree.quote(FortiOsNames.nameOf(device, parent)));
-            entry.set("vlanid", device.vlans?.[iface.vlan]?.id ?? 0);
+            entry.set("vlanid", device.switching?.vlans?.[iface.vlan]?.id ?? 0);
             const domain = FortiOsNames.forwardDomainOf(device, name);
             if (domain) entry.set("forward-domain", domain);
             if (iface.description) entry.set("description", FortiOsTree.quote(iface.description));
@@ -443,8 +445,8 @@ export class FortiOsRender {
             FortiOsRender.routed(entry, device, name, iface, access);
         }
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type !== "loopback") continue;
+        for (const [name, iface] of Object.entries(device.interfaces?.loopback ?? {})) {
+            if (!iface) continue;
 
             const entry = block.entry(name);
             entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, name)));
@@ -455,31 +457,34 @@ export class FortiOsRender {
         }
 
         // A tunnel's interface is created by its own table, which names the interface it leaves through.
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type !== "gre" && iface.type !== "vxlan") continue;
+        for (const { name, kind, settings } of FortiOsNames.interfacesOf(device)) {
+            if (kind !== "gre" && kind !== "vxlan") continue;
+
+            const iface = settings as Gre | Vxlan;
+            const vxlan = kind === "vxlan" ? (settings as Vxlan) : undefined;
 
-            const outgoing = FortiOsNames.holderOf(device, iface.local);
+            const outgoing = FortiOsNames.holderOf(device, iface.local_address);
             const via = outgoing ? FortiOsTree.quote(FortiOsNames.nameOf(device, outgoing)) : '""';
 
             // Between IPv6 endpoints the family is stated first: the addresses of the other family are not settings until it is.
-            const ipv6 = Address.family(iface.remote) === "ipv6";
+            const ipv6 = Address.family(iface.remote_address) === "ipv6";
 
-            if (iface.type === "gre") {
+            if (!vxlan) {
                 const tunnel = root.block("system gre-tunnel").entry(name).set("interface", via);
-                if (ipv6) tunnel.set("ip-version", 6).set("remote-gw6", iface.remote).set("local-gw6", iface.local);
-                else tunnel.set("remote-gw", iface.remote).set("local-gw", iface.local);
+                if (ipv6) tunnel.set("ip-version", 6).set("remote-gw6", iface.remote_address).set("local-gw6", iface.local_address);
+                else tunnel.set("remote-gw", iface.remote_address).set("local-gw", iface.local_address);
             } else {
-                const tunnel = root.block("system vxlan").entry(name).set("interface", via).set("vni", iface.vni);
-                if (ipv6) tunnel.set("ip-version", "ipv6-unicast").set("remote-ip6", FortiOsTree.quote(iface.remote));
-                else tunnel.set("remote-ip", FortiOsTree.quote(iface.remote));
-                if (iface.port !== undefined && iface.port !== 4789) tunnel.set("dstport", iface.port);
+                const tunnel = root.block("system vxlan").entry(name).set("interface", via).set("vni", vxlan.vni);
+                if (ipv6) tunnel.set("ip-version", "ipv6-unicast").set("remote-ip6", FortiOsTree.quote(vxlan.remote_address));
+                else tunnel.set("remote-ip", FortiOsTree.quote(vxlan.remote_address));
+                if (vxlan.port !== undefined && vxlan.port !== 4789) tunnel.set("dstport", vxlan.port);
             }
 
             const entry = block.entry(name);
             entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, name)));
-            entry.set("type", iface.type === "gre" ? "tunnel" : "vxlan");
+            entry.set("type", vxlan ? "vxlan" : "tunnel");
             entry.set("interface", via);
-            if (iface.type === "vxlan" && iface.mac) entry.set("macaddr", iface.mac.toLowerCase());
+            if (vxlan?.mac) entry.set("macaddr", vxlan.mac.toLowerCase());
             if (iface.description) entry.set("description", FortiOsTree.quote(iface.description));
             if (iface.mtu) entry.set("mtu-override", "enable").set("mtu", iface.mtu);
             FortiOsRender.redirects(entry, device);
@@ -489,14 +494,14 @@ export class FortiOsRender {
 
     /** The platform sends ICMP redirects unless an interface says otherwise; the config sends them only when asked. */
     private static redirects(entry: FortiOsBlock, device: Device): void {
-        if (!device.system?.ip?.icmp_redirects) entry.set("icmp-send-redirect", "disable");
+        if (!device.system?.ip_stack?.icmp_redirects) entry.set("icmp-send-redirect", "disable");
     }
 
     /** The one port or LAG that carries a VLAN tagged, which its VLAN interface sits on. `unsupported()` refuses any other case. */
     static vlanParent(device: Device, vlan: string): string | undefined {
         const carriers = [
-            ...Object.entries(device.ports ?? {}).filter(([, port]) => !port?.lag && port?.trunk_vlans?.includes(vlan)),
-            ...Object.entries(device.interfaces ?? {}).filter(([, iface]) => iface.type === "lag" && iface.trunk_vlans?.includes(vlan)),
+            ...Derive.ports(device).filter(([, port]) => !port.in_lag && port.trunk_vlans?.includes(vlan)),
+            ...Object.entries(device.interfaces?.lag ?? {}).filter(([, lag]) => lag?.trunk_vlans?.includes(vlan)),
         ];
 
         return carriers.length === 1 ? carriers[0]![0] : undefined;
@@ -522,11 +527,11 @@ export class FortiOsRender {
         if (vrf) entry.set("vrf", vrf);
 
         // A tunnel holds an IPv4 address as a host and its peer with the link's mask.
-        const peer = settings.addresses?.find((item): item is { address: string; peer: string } => typeof item !== "string");
+        const peer = settings.addresses?.find((item): item is { address: string; peer_address: string } => typeof item !== "string");
 
         if (peer) {
             entry.set("ip", `${Address.host(peer.address)} 255.255.255.255`);
-            entry.set("remote-ip", `${peer.peer} ${Address.netmask(Address.split(peer.address).len)}`);
+            entry.set("remote-ip", `${peer.peer_address} ${Address.netmask(Address.split(peer.address).len)}`);
             entry.set("allowaccess", access);
         } else if (ipv4.length) {
             entry.set("ip", FortiOsNames.subnet(ipv4[0]!));
@@ -544,7 +549,7 @@ export class FortiOsRender {
             );
         }
 
-        const relays = Object.values(device.dhcp_relay ?? {}).filter((relay) => relay.interface === name);
+        const relays = Object.values(device.services?.dhcp_relay ?? {}).filter((relay) => relay.interface === name);
         const relayed = relays.flatMap((relay) => relay.servers);
         const relayed4 = relayed.filter((server) => Address.family(server) === "ipv4");
         const relayed6 = relayed.filter((server) => Address.family(server) === "ipv6");
@@ -589,15 +594,16 @@ export class FortiOsRender {
         }
 
         // LLDP follows the device unless a port says otherwise, or the device lists where it runs.
-        const listed = typeof device.lldp === "object" && device.lldp.interfaces.includes(name as never);
+        const lldp = device.switching?.lldp;
+        const listed = typeof lldp === "object" && lldp.interfaces.includes(name);
         if (settings.lldp === false) entry.set("lldp-transmission", "disable").set("lldp-reception", "disable");
-        else if (listed || (settings.lldp === true && device.lldp !== true))
+        else if (listed || (settings.lldp === true && lldp !== true))
             entry.set("lldp-transmission", "enable").set("lldp-reception", "enable");
 
         // A tunnel is not sampled: its traffic is, on the interface it leaves through.
-        const flow = device.flow_export;
-        const tunnel = ["gre", "vxlan"].includes(device.interfaces?.[name]?.type ?? "");
-        const sampled = flow && !tunnel && (!flow.interfaces || flow.interfaces.includes(name as never));
+        const flow = device.monitoring?.flow_export;
+        const tunnel = FortiOsNames.isTunnel(device, name);
+        const sampled = flow && !tunnel && (!flow.interfaces || flow.interfaces.includes(name));
 
         if (sampled && flow.protocol === "sflow") {
             entry.set("sflow-sampler", "enable");
@@ -619,7 +625,8 @@ export class FortiOsRender {
         if (ipv6[1]) block.set("ip6-secondary", ipv6[1]);
 
         // Recursive, the default mode, answers from what the device has resolved itself.
-        if (device.system?.dns?.serve) for (const name of FortiOsNames.addressed(device)) servers.entry(FortiOsNames.nameOf(device, name));
+        if (device.services?.dns_server)
+            for (const name of FortiOsNames.addressed(device)) servers.entry(FortiOsNames.nameOf(device, name));
     }
 
     /** The servers the device keeps time from, and the interfaces it answers time queries on when it serves them. */
@@ -635,7 +642,7 @@ export class FortiOsRender {
             servers.forEach((server, index) => list.entry(index + 1).set("server", FortiOsTree.quote(server)));
         }
 
-        if (ntp?.serve) {
+        if (device.services?.ntp_server) {
             block.set("server-mode", "enable");
             block.set("interface", FortiOsTree.quoteAll(FortiOsNames.addressed(device).map((name) => FortiOsNames.nameOf(device, name))));
         }
@@ -643,7 +650,7 @@ export class FortiOsRender {
 
     /** SNMP version 2c with one community, guarded by its hosts, and version 3 users. */
     private static snmp(root: FortiOsBlock, device: Device): void {
-        const snmp = device.management?.snmp;
+        const snmp = device.monitoring?.snmp;
         if (!snmp) return;
 
         const sysinfo = root.block("system snmp sysinfo");
@@ -655,7 +662,7 @@ export class FortiOsRender {
             const community = root.block("system snmp community").entry(1);
             community.set("name", FortiOsTree.quote(Secrets.marker(snmp.community)));
 
-            const allow = snmp.allow ?? device.management?.allow ?? [];
+            const allow = snmp.allow ?? FortiOsNames.allowed(device);
             const ipv4 = allow.filter((prefix) => Address.family(Address.host(prefix)) === "ipv4");
             const ipv6 = allow.filter((prefix) => Address.family(Address.host(prefix)) === "ipv6");
             ipv4.forEach((prefix, index) =>
@@ -701,7 +708,7 @@ export class FortiOsRender {
         // The disk keeps logs unless told not to; the config keeps them only in memory.
         root.block("log disk setting").set("status", "disable");
 
-        (logging?.remote ?? []).slice(0, FortiOsRender.COLLECTORS).forEach((collector, index) => {
+        (device.monitoring?.syslog ?? []).slice(0, FortiOsRender.COLLECTORS).forEach((collector, index) => {
             const number = index === 0 ? "" : String(index + 1);
             const setting = root.block(`log syslogd${number} setting`);
             setting.set("status", "enable");
@@ -714,7 +721,7 @@ export class FortiOsRender {
 
     /** One collector, and sampling on each interface it observes. */
     private static flowExport(root: FortiOsBlock, device: Device): void {
-        const flow = device.flow_export;
+        const flow = device.monitoring?.flow_export;
         const collector = flow?.collectors[0];
         if (!flow || !collector) return;
 
@@ -730,7 +737,7 @@ export class FortiOsRender {
     }
 
     private static dhcpServers(block: FortiOsBlock, device: Device): void {
-        Object.values(device.dhcp ?? {}).forEach((server, index) => {
+        Object.values(device.services?.dhcp_server ?? {}).forEach((server, index) => {
             const entry = block.entry(index + 1);
             if (server.lease_time !== undefined && server.lease_time !== 604800) entry.set("lease-time", server.lease_time);
             entry.set("default-gateway", server.gateway);
@@ -750,10 +757,10 @@ export class FortiOsRender {
     }
 
     /** Each route by its position. A route goes in the routing table of the interface it leaves through. A default route is the platform's default destination and is not printed. */
-    private static staticRoutes(ipv4: FortiOsBlock, ipv6: FortiOsBlock, device: Device): void {
+    private static staticRoutes(ipv4: FortiOsBlock, ipv6: FortiOsBlock, device: Device, routes: readonly StaticRoute[]): void {
         const counters = { ipv4: 0, ipv6: 0 };
 
-        for (const route of device.routing?.static ?? []) {
+        for (const route of routes) {
             const family = Address.family(Address.split(route.prefix).addr);
             const entry = (family === "ipv4" ? ipv4 : ipv6).entry(++counters[family]);
             const prefix = FortiOsNames.network(route.prefix);
@@ -761,10 +768,10 @@ export class FortiOsRender {
             if (family === "ipv6" && prefix !== "::/0") entry.set("dst", prefix);
             if (family === "ipv4" && prefix !== "0.0.0.0/0") entry.set("dst", FortiOsNames.subnet(prefix));
 
-            if (route.via) entry.set("gateway", route.via);
+            if (route.next_hop) entry.set("gateway", route.next_hop);
 
             // In transparent mode a route names no interface: it carries only the management address's own traffic.
-            const outgoing = route.interface ?? (route.via ? FortiOsNames.interfaceFor(device, route.via, route.vrf) : undefined);
+            const outgoing = route.interface ?? (route.next_hop ? FortiOsNames.interfaceFor(device, route.next_hop, route.vrf) : undefined);
             if (outgoing && !route.blackhole && !FortiOsNames.isTransparent(device))
                 entry.set("device", FortiOsTree.quote(FortiOsNames.nameOf(device, outgoing)));
 
@@ -793,7 +800,7 @@ export class FortiOsRender {
     private static helpers(block: FortiOsBlock, device: Device): void {
         let number = 0;
 
-        for (const helper of device.firewall?.helpers ?? []) {
+        for (const helper of device.firewall?.conntrack_helpers ?? []) {
             for (const [name, protocol, port] of FortiOsRender.HELPERS[helper] ?? [])
                 block.entry(++number).set("name", name).set("protocol", protocol).set("port", port);
         }